[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flPwmTjw3lIXCBqrM_QzuRjpAf6gipakIslonpDoum9E":3},{"article":4,"iocs":50,"watch_terms":51,"solutions":52,"lesson":101},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"704af1dc-36f4-44b0-b4c6-946f24bd56fe","FedRAMP VDR & VER: Daily Scans Are Only the Beginning","fedramp-vdr-ver-daily-scans-are-only-the-beginning-1c3c43","FedRAMP's new VDR and VER requirements make vulnerability management more continuous, with faster scanning, tighter remediation deadlines, and stronger evidence requirements. Anecdotes explains why the December 7 deadline is just the beginning of a broader shift toward continuous, automated compliance validation. [...]","FedRAMP is implementing new Vulnerability Detection and Response (VDR) and Vulnerability Evidence and Validation (VER) rules, effective December 7, 2026. These rules shift from a monthly scan and Plan of Actions & Milestones (POA&M) model to more continuous vulnerability management with faster scanning frequencies, tiered remediation deadlines based on exploitability, and a requirement to assume exploits are automatable unless proven otherwise. Process failures in vulnerability detection are also now considered vulnerabilities, emphasizing a move towards automated, continuous compliance validation for cloud service offerings.","FedRAMP mandates new VDR and VER rules for cloud service offerings by December 7, 2026.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffedramp-vdr-and-ver-daily-scans-are-only-the-beginning\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fposts\u002F2026\u002F09\u002F23\u002Fanecdotes-fedramp.jpg","2026-09-24T14:02:12+00:00","2026-09-24T20:00:23.823705+00:00",7,[17,20,23,25],{"name":18,"type":19},"FedRAMP","product",{"name":21,"type":22},"VDR","technology",{"name":24,"type":22},"VER",{"name":26,"type":19},"CISA BOD 26-04","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":27,"icon":29,"name":30,"slug":31},null,"Policy","policy",[33,38,43,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"217d3263-c763-41ca-875e-06901f522fe0","NIST","nist",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":44},{"id":27,"icon":29,"name":30,"slug":31},{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[18,26],{"controls":53,"vendors":100},[54,83],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":84,"name":85,"problem":86,"products":87},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.",[88,94],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":89,"product_name":90,"url":92,"description":93},"drata","Drata","\u002Fvendor-logos\u002Fdrata.png","https:\u002F\u002Fdrata.com\u002F","Continuous control monitoring and audit readiness across security frameworks.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":95,"product_name":96,"url":98,"description":99},"vanta","Vanta","\u002Fvendor-logos\u002Fvanta.png","https:\u002F\u002Fwww.vanta.com\u002F","Automated evidence collection and continuous monitoring for ISO 27001, SOC 2, NIS2 and other frameworks.",[],{"slug":102,"title":103,"body":104,"framework_refs":105,"framework_notes":116},"fedramp-mandates-continuous-vulnerability-management-beyond-monthly-scans","FedRAMP Mandates Continuous Vulnerability Management Beyond Monthly Scans","The new FedRAMP VDR and VER requirements signal a fundamental shift away from periodic, checkbox-driven vulnerability scanning toward continuous, evidence-based vulnerability management. Organizations relying solely on monthly scans and slow POA&M cycles are leaving dangerous windows of exposure, especially as threat actors increasingly leverage automated exploit tooling. The rule change introduces tiered remediation deadlines tied to exploitability risk, meaning high-risk vulnerabilities must be addressed far faster than legacy processes allow. Critically, failures in the vulnerability detection process itself are now classified as vulnerabilities, raising the stakes for organizations with immature or inconsistent scanning practices. Cloud service providers that fail to modernize their vulnerability management programs risk both compliance violations and real-world breaches.",[106,107,108,109,110,111,112,113,114,115],"NIST SP 800-53 RA-5 (Vulnerability Monitoring and Scanning)","NIST SP 800-53 SI-2 (Flaw Remediation)","NIST SP 800-53 CA-7 (Continuous Monitoring)","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","FedRAMP VDR (Vulnerability Detection and Response) Policy, effective December 7 2026","FedRAMP VER (Vulnerability Evidence and Validation) Policy, effective December 7 2026","CISA Known Exploited Vulnerabilities (KEV) Catalog","NIST SP 800-137: Information Security Continuous Monitoring (ISCM)","FedRAMP Continuous Monitoring Strategy Guide",{}]